ff877b5f0373267f1b02e1f897161c1ff8b700eb51af62258256e94f22210cf9

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
19-12-2022 17:40

Target

08a5c87ab1ea14d269adfc5ae54db174b3465d0a7d9ba590dd6606091440b9b7.exe
Size

1.1MB
MD5

c9234f802b4fb9bcf16237d438fa86e6
SHA1

81b2eb0d8d06c0006929a3e0ebdaf6615aca1908
SHA256

08a5c87ab1ea14d269adfc5ae54db174b3465d0a7d9ba590dd6606091440b9b7
SHA512

8c018af20bad4de00125fe1cdbeb7b8bb059846b7b67c75d31cd12bb909b7f012517bb7d31641a2d7156cf3a9798cccd14dd542f5e2079bd0d47a29c96102bd3
SSDEEP

24576:VM6foBca4H/sQ0NG6LdS9tbtOTxGIraEgsKiZZK3QASvzK6r:jfe/k/su6LatMDcsKKZYSvzKM

Score

8^/10

Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exe

flow pid process

4 4840 rundll32.exe
5 4840 rundll32.exe
40 4840 rundll32.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

4840 rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4304 4756 WerFault.exe 08a5c87ab1ea14d269adfc5ae54db174b3465d0a7d9ba590dd6606091440b9b7.exe

pid	process
4840	rundll32.exe

pid	pid_target	process	target process
4304	4756	WerFault.exe	08a5c87ab1ea14d269adfc5ae54db174b3465d0a7d9ba590dd6606091440b9b7.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

08a5c87ab1ea14d269adfc5ae54db174b3465d0a7d9ba590dd6606091440b9b7.exe

description	pid	process	target process
PID 4756 wrote to memory of 4840	4756	08a5c87ab1ea14d269adfc5ae54db174b3465d0a7d9ba590dd6606091440b9b7.exe	rundll32.exe
PID 4756 wrote to memory of 4840	4756	08a5c87ab1ea14d269adfc5ae54db174b3465d0a7d9ba590dd6606091440b9b7.exe	rundll32.exe
PID 4756 wrote to memory of 4840	4756	08a5c87ab1ea14d269adfc5ae54db174b3465d0a7d9ba590dd6606091440b9b7.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\08a5c87ab1ea14d269adfc5ae54db174b3465d0a7d9ba590dd6606091440b9b7.exe
"C:\Users\Admin\AppData\Local\Temp\08a5c87ab1ea14d269adfc5ae54db174b3465d0a7d9ba590dd6606091440b9b7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 532
2⤵
- Program crash
PID:4304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4756 -ip 4756
1⤵
PID:4848

C:\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmp

Filesize
726KB

MD5
6ea8a6cc5fed6c664df1b3ef7c56b55d

SHA1
6b244d708706441095ae97294928967ddf28432b

SHA256
2c7500ac5ebb0116e640747b8a5f0a2648f7d2f5f516ebb398b864cccc626fbe

SHA512
4a328a66df407e4c9fa230287104771ea3b5dd8265d60314797426101a8be19d13bc57de2388f0f90b20ada82d950e156ef4267c029080a6254b80eefd8b8741

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmp

Filesize
726KB

MD5
6ea8a6cc5fed6c664df1b3ef7c56b55d

SHA1
6b244d708706441095ae97294928967ddf28432b

SHA256
2c7500ac5ebb0116e640747b8a5f0a2648f7d2f5f516ebb398b864cccc626fbe

SHA512
4a328a66df407e4c9fa230287104771ea3b5dd8265d60314797426101a8be19d13bc57de2388f0f90b20ada82d950e156ef4267c029080a6254b80eefd8b8741

Download Submit
memory/4756-133-0x00000000022EA000-0x00000000023C0000-memory.dmp

Filesize
856KB

Download
memory/4756-134-0x00000000023D0000-0x00000000024E5000-memory.dmp

Filesize
1.1MB

Download
memory/4756-136-0x0000000000400000-0x0000000000517000-memory.dmp

Filesize
1.1MB

Download
memory/4840-132-0x0000000000000000-mapping.dmp

Download